All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

I've been in touch with support, this is a known issue and there's no plan to fix. There is a workaround that can be used:   | map [search index=_internal [| makeresults | eval earliest=$earliest$... See more...
I've been in touch with support, this is a known issue and there's no plan to fix. There is a workaround that can be used:   | map [search index=_internal [| makeresults | eval earliest=$earliest$, latest=$latest$ | return earliest, latest]     It's a bit longer and needs another subsearch, but can be easier than escaping everything.   Thanks everyone for their input @PickleRick @richgalloway 
Thank you for your reply. I will choose the Splunk-supported add-on.
Hi @tscroggins ,  Thanks for your reply, then do you perhaps know if they're any time-range args that work with input-dashboard ? Otherwise, should i use another method ?
Hi , I am facing the same issue and found this thread. Was the issue resolved ? Can you let me know the fix please if this is working for you now. Thanks
Hello All, Has anyone encountered a situation like this before? Thanks!
No. One is written by Palo Alto themselves - https://splunkbase.splunk.com/app/2757 It's the older one and it's now deprecated. The new one is written and supported by Splunk - https://splunkbase.s... See more...
No. One is written by Palo Alto themselves - https://splunkbase.splunk.com/app/2757 It's the older one and it's now deprecated. The new one is written and supported by Splunk - https://splunkbase.splunk.com/app/7523 Go for this one. As a rule of thumb if you have a choice between a Splunk-supported add-on and a third-party one use the Splunk-supported one.
Hi @dhineshv1 , OK, where is located the information if a currency is local or foreigner? I suppose that's related to the user account. So you could create a lookup containing the system users and... See more...
Hi @dhineshv1 , OK, where is located the information if a currency is local or foreigner? I suppose that's related to the user account. So you could create a lookup containing the system users and the related currency. Then an input with two options: local or foreigner. in local you could use the following expression: [ | rest /services/authentication/current-context | lookup your lookup.csv title OUTPUT Currency | table Currency ] instead in foreigner, you could use the following expression: NOT [ | rest /services/authentication/current-context | lookup your lookup.csv title OUTPUT Currency | table Currency ] In this way you can filter your search in this way: <your_main_search> $token$ | ... Ciao. Giuseppe
Hi @AliMaher , as also @PickleRick and @richgalloway said, the correct reference hardware and the number of SHs depends not only on the number of active users but mainly on the number of searches th... See more...
Hi @AliMaher , as also @PickleRick and @richgalloway said, the correct reference hardware and the number of SHs depends not only on the number of active users but mainly on the number of searches that you have in your infrastructure, with special attention to scheduled searches. In addition it depends also on the presence of Premium Apps like Enterprise Security or ITSI that use many scheduled searches. You can monitor the load on the SH using the Monitoring Console: if the load on the SH is too high, you can think to add another SH or increase the reference hardware (CPUs). The use of a Cluster depends on if you have the requirement of HA or not, not on the load on SH. In addition, when you monitor the performances of your infrastructure, remember to monitor also the load on Indexers because all the searches from SHs arrive on Indexers: you can monitor Indexers performaces using still the Monitoring Console. Anyway, the best approach is to analyze the requirements, in terms di indexed logs, scheduled searces,  active users and presence of Premium Apps with a Splunk Architect that can design the best architecture for your infrastructure. Ciao. Giuseppe
Hi, Thanks for responding, let me try to explain it clearly, Refer to the below table on how my data look like Currency Amount Card Brand JPY 100 XXX CNY 100 XYZ INR 100 UUU ... See more...
Hi, Thanks for responding, let me try to explain it clearly, Refer to the below table on how my data look like Currency Amount Card Brand JPY 100 XXX CNY 100 XYZ INR 100 UUU   1. I should have a dropdown name currency and list down 2 options, one will be Local (assume JPY is local here currency in this case), second option will be cross border   2. When i choose Local, then i need to show the result where the currency = JPY (this is straight forward one) Currency Amount Card Brand JPY 100 XXX   3. When i choose cross border, then i need to show the result where the currency ! = JPY (i.e all results except JPY as below) CNY 100 XYZ INR 100 UUU
Hi @kumva01 As you tagged Splunk Addon for Unix and Linux, i assume you are using this addon.  if yes, then the addon will take care of the sourcetype automatically. here is the list of sourcetypes... See more...
Hi @kumva01 As you tagged Splunk Addon for Unix and Linux, i assume you are using this addon.  if yes, then the addon will take care of the sourcetype automatically. here is the list of sourcetypes of the unix/linux addon: https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/Sourcetypes and here is the list of pretrained sourcetypes: https://docs.splunk.com/Documentation/Splunk/9.3.1/Data/Listofpretrainedsourcetypes Pls suggest more details about your question, thanks. 
Hi @dhineshv1 , sorry but your request isn't so clear, let me summarize and correct me if there's somethinh wrong: you need to add a dropdown containing all the currecies present in your data, cho... See more...
Hi @dhineshv1 , sorry but your request isn't so clear, let me summarize and correct me if there's somethinh wrong: you need to add a dropdown containing all the currecies present in your data, choosing a currency from the dropdown, you want to use this currency near your value or what else? it's not clear "but my  query i should differentiate between local and foreign currency, for example user have to search by selecting 1st option as JPY and another option should list me all the other currency except JPY,", what do you mean? could you add a sampe of the output you whould? Ciao. Giuseppe
Hi All, We are in the process of onboarding logs from a centralized log server, where all endpoints forward their logs. We have installed a Splunk Heavy Forwarder on the server to monitor and forwar... See more...
Hi All, We are in the process of onboarding logs from a centralized log server, where all endpoints forward their logs. We have installed a Splunk Heavy Forwarder on the server to monitor and forward these logs to the Indexers. I would like to know if there are any default sourcetypes available for data sources such as systemd.log and sudo.log  
Yes, WhatsApp does offer the "WhatsApp Business API," which is a paid service designed for businesses to interact with their customers at scale. Unlike free platforms like Telegram or GroupMe, which ... See more...
Yes, WhatsApp does offer the "WhatsApp Business API," which is a paid service designed for businesses to interact with their customers at scale. Unlike free platforms like Telegram or GroupMe, which provide open Bot APIs for developers, WhatsApp's API has a cost and requires approval from Meta. This difference is why many developers prefer Telegram or GroupMe for creating bots, as they offer similar functionality without the upfront fees and restrictions of WhatsApp's Business API.
I am using JAVA SDK to display data on screen. There was no error in version 1.6.0, which I initially used. However, after updating to 1.6.3, the following error appeared. This error is "java.l... See more...
I am using JAVA SDK to display data on screen. There was no error in version 1.6.0, which I initially used. However, after updating to 1.6.3, the following error appeared. This error is "java.lang.NumberFormatException: multiple points". This happens randomly when a service connects or a job is performed. 2024-10-21 12:16:53.899 ERROR 2732 --- [nio-8090-exec-4] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] threw exception   java.lang.NumberFormatException: multiple points at java.base/jdk.internal.math.FloatingDecimal.readJavaFormatString(FloatingDecimal.java:1890) ~[na:na] Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:  Assembly trace from producer [reactor.core.publisher.MonoCompletionStage] : reactor.core.publisher.Mono.fromCompletionStage(Mono.java:549) org.springframework.core.ReactiveAdapterRegistry$ReactorRegistrar.lambda$registerAdapters$4(ReactiveAdapterRegistry.java:241) Error has been observed at the following site(s): |_ Mono.fromCompletionStage ⇢ at org.springframework.core.ReactiveAdapterRegistry$ReactorRegistrar.lambda$registerAdapters$4(ReactiveAdapterRegistry.java:241) Stack trace: at java.base/jdk.internal.math.FloatingDecimal.readJavaFormatString(FloatingDecimal.java:1890) ~[na:na] at java.base/jdk.internal.math.FloatingDecimal.parseDouble(FloatingDecimal.java:110) ~[na:na] at java.base/java.lang.Double.parseDouble(Double.java:543) ~[na:na] at java.base/java.text.DigitList.getDouble(DigitList.java:169) ~[na:na] at java.base/java.text.DecimalFormat.parse(DecimalFormat.java:2126) ~[na:na] at java.base/java.text.SimpleDateFormat.subParse(SimpleDateFormat.java:1933) ~[na:na] at java.base/java.text.SimpleDateFormat.parse(SimpleDateFormat.java:1541) ~[na:na] at java.base/java.text.DateFormat.parse(DateFormat.java:393) ~[na:na] at com.splunk.Value.toDate(Value.java:109) ~[splunk-1.6.3.0.jar:1.6.3] at com.splunk.Resource.load(Resource.java:166) ~[splunk-1.6.3.0.jar:1.6.3] at com.splunk.Entity.load(Entity.java:356) ~[splunk-1.6.3.0.jar:1.6.3] at com.splunk.Job.refresh(Job.java:940) ~[splunk-1.6.3.0.jar:1.6.3] at com.splunk.JobCollection.create(JobCollection.java:90) ~[splunk-1.6.3.0.jar:1.6.3] at com.splunk.JobCollection.create(JobCollection.java:108) ~[splunk-1.6.3.0.jar:1.6.3] at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218) ~[spring-core-5.3.4.jar:5.3.4] at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:779) ~[spring-aop-5.3.4.jar:5.3.4] at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) ~[spring-aop-5.3.4.jar:5.3.4] at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:750) ~[spring-aop-5.3.4.jar:5.3.4] at org.springframework.aop.interceptor.AsyncExecutionInterceptor.lambda$invoke$0(AsyncExecutionInterceptor.java:115) ~[spring-aop-5.3.4.jar:5.3.4] at org.springframework.aop.interceptor.AsyncExecutionAspectSupport.lambda$doSubmit$3(AsyncExecutionAspectSupport.java:276) ~[spring-aop-5.3.4.jar:5.3.4] at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1700) ~[na:na] at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java) ~[na:na   Has anyone solved this error?  
Hi, I have an log which show currency field and it will have all the valid currency codes like JPY, CNY, USD etc.. I need to add a dropdown on top with currency value, but my  query i should differ... See more...
Hi, I have an log which show currency field and it will have all the valid currency codes like JPY, CNY, USD etc.. I need to add a dropdown on top with currency value, but my  query i should differentiate between local and foreign currency, for example user have to search by selecting 1st option as JPY and another option should list me all the other currency except JPY, I am not sure if this possible in splunk, need experts advice here. Currency Amount Card Brand JPY 100 XXX CNY 100 XYZ INR 100 UUU
Yes both parameters password and oldpassword are correct and yes I'm trying to update local user
In the new update of TrendVision One Splunk for XDR, there is a new input configuration called 'Detection.' However, I am confused about whether OAT or Detection should be enabled, as they cannot be ... See more...
In the new update of TrendVision One Splunk for XDR, there is a new input configuration called 'Detection.' However, I am confused about whether OAT or Detection should be enabled, as they cannot be enabled simultaneously. Which one should be enabled in both cases?
The palo alto server transmit the syslog with the port 5514. (514 port was in use) And I search with the query "source="udp:5514"". Is there any problem in the query ?
Thank you for your reply. There are two add-ons "Palo Alto Networks Add-on" and "Splunk Add-on for Palo Alto Networks". Is there okay to go with either one ? The video I referred on Youtube was ab... See more...
Thank you for your reply. There are two add-ons "Palo Alto Networks Add-on" and "Splunk Add-on for Palo Alto Networks". Is there okay to go with either one ? The video I referred on Youtube was about "Palo Alto Networks Add-on", and search result was displayed successfully. I confirmed that the splunk server could received the syslog packets successfully using tshark. what is the problem in displaying the search results.
Hi all, I am trying to understand data in sourcetype=pan:hipmatch for a VPN posture check use case. Has anyone developed or know of any dashboards developed on pan:hip match data and what fields can... See more...
Hi all, I am trying to understand data in sourcetype=pan:hipmatch for a VPN posture check use case. Has anyone developed or know of any dashboards developed on pan:hip match data and what fields can be use to correlate it with pan:globalprotect. Appreciate any pointers